Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   isaku.yamahata@intel.com
To:     kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Cc:     isaku.yamahata@intel.com, isaku.yamahata@gmail.com,
        Michael Roth <michael.roth@amd.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        Sean Christopherson <seanjc@google.com>, erdemaktas@google.com,
        Sagi Shahar <sagis@google.com>,
        David Matlack <dmatlack@google.com>,
        Kai Huang <kai.huang@intel.com>,
        Zhi Wang <zhi.wang.linux@gmail.com>, chen.bo@intel.com,
        linux-coco@lists.linux.dev,
        Chao Peng <chao.p.peng@linux.intel.com>,
        Ackerley Tng <ackerleytng@google.com>,
        Vishal Annapurve <vannapurve@google.com>,
        Yuan Yao <yuan.yao@linux.intel.com>
Subject: [RFC PATCH v4 10/10] KVM: X86: KVM_MEM_ENC_OP check if unused field (flags, error) is zero
Date:   Thu, 20 Jul 2023 16:32:56 -0700
Message-Id: <cf4e12dbe7d8d759ff87e088ade54bd710926d1e.1689893403.git.isaku.yamahata@intel.com>
In-Reply-To: <cover.1689893403.git.isaku.yamahata@intel.com>
References: <cover.1689893403.git.isaku.yamahata@intel.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Isaku Yamahata <isaku.yamahata@intel.com>

This breaks uABI as the current code doesn't check padding and sev_fd
when unused.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
---
Changes v3 -> v4:
- newly added
---
 arch/x86/kvm/x86.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index ab36e8940f1b..1d6085af6a00 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7055,6 +7055,22 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
 			r = -EFAULT;
 			goto out;
 		}
+		/* No sub-command uses flags at the moment. */
+		if (cmd.flags) {
+			r = -EINVAL;
+			goto out;
+		}
+		if (cmd.id != KVM_SEV_LAUNCH_START &&
+		    cmd.id != KVM_SEV_RECEIVE_START && cmd.error64) {
+			r = -EINVAL;
+			goto out;
+		}
+		if ((cmd.id == KVM_SEV_LAUNCH_START ||
+		     cmd.id == KVM_SEV_RECEIVE_START) && cmd.error) {
+			r = -EINVAL;
+			goto out;
+		}
+
 		r = static_call(kvm_x86_mem_enc_ioctl)(kvm, &cmd);
 		if (copy_to_user(argp, &cmd, sizeof(cmd)))
 			r = -EFAULT;
-- 
2.25.1